Description
Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | frappe | 16.0.0 – < 16.33.0, < 15.120.0 | 16.33.0 |
References
- GitHub Security Advisory (GHSA-h9jq-7pgf-hw8q) vendor-advisory
- VulnCheck Advisory: Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication third-party-advisory